hamsters[.]solcore[.]cc

Analysis of hamsters.solcore.cc, observed on July 24 2026, indicates that the domain is currently offline but retains infrastructure consistent with a crypto‑related phishing operation. The domain was registered on August 07 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is delegated to the Cloudflare nameservers ligia.ns.cloudflare.com and steven.ns.cloudflare.com. DNS resolution points to the IP address 104.21.87.201, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, and an HTTP request returns a 404 Not Found page title, suggesting the site has been taken down or is intentionally serving an error page.

The Gridinsoft trust score of 0 out of 100 reflects a severely low reputation. The domain is listed on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that nine of ninety‑five scanners flagged the domain, providing additional corroboration of malicious intent. The available intelligence labels the campaign as a crypto scam, aligning with the observed infrastructure and the lack of legitimate content.

Uncertainty remains regarding the exact payload or victim interaction flow, as no landing page content or phishing kit details have been captured. Defenders should continue to block the domain at network perimeter devices, update DNS‑based filtering rules to include the listed nameservers and IP address, and monitor for any re‑activation attempts. Threat‑intel feeds should be enriched with the registration details and the observed blocklist identifiers to aid in cross‑correlation with future incidents. Continuous re‑scanning on platforms such as VirusTotal is advised to capture any changes in detection status.